On June 12, the OCR published the following guidance: OCR Issues Guidance on How Health Care Providers Can Contact Former COVID-19 Patients About Blood and Plasma Donation Opportunities.
This guidance explains when PHI can be used to identify and contact patients who had COVID-19 about donating blood and plasma to help treat other COVID-19 patients:
- Covered entities (or their business associates) CAN, under HIPAA, use PHI to identify and contact patients who have recovered from COVID-19 to provide information about donating blood and plasma that could help other COVID-19 patients. The COVID-19 antibodies found in blood and plasma of recovered patients could help treat other COVID-19 patients.
- This use of PHI is considered health care operations, because it involves “population-based activities related to improving health, and case management and care coordination activities that do not meet the definition of treatment….”
- Covered entities should limit the use or disclosure of PHI to the minimum necessary.
- Providers must be careful here – the way they reach out to patients must not constitute marketing. (With some exceptions, uses or disclosures of PHI for marketing require a signed HIPAA authorization).
- Covered entities should NOT receive any direct or indirect payment from or on behalf of a blood and plasma donation center.
- Covered entities should refrain from encouraging patients to use a particular blood and plasma center.
- Covered entities cannot disclose PHI about recovered COVID-19 patients to a blood and plasma donation center for the purpose of soliciting blood and plasma donations – without a signed patient authorization.
MPA has updated its HIPAA & COVID-19 Tool Kit to address this guidance. The following documents have been updated:
- HIPAA & COVID-19 Update
- Permitted Uses and Disclosures Policy
Providers who previously purchased the HIPAA & COVID-19 Tool Kit have received these updated downloads by email. To purchase the HIPAA & COVID-19 Tool Kit, click here.
